This is an important annoucement.
Widely deployed OSS projects that are critical to global infrastructure and innovation have become top targets for adversarial attacks. Following new vulnerability disclosures, adversary attacks can be seen within hours. For example, recently discovered vulnerabilities in the widely deployed Log4j library forced many organizations into crisis as they raced to update applications using the popular library before adversaries could attack.
The Alpha-Omega Project will improve global OSS supply chain security by working with project maintainers to systematically look for new, as-yet-undiscovered vulnerabilities in open source code, and get them fixed. “Alpha” will work with the maintainers of the most critical open source projects to help them identify and fix security vulnerabilities, and improve their security posture. “Omega” will identify at least 10,000 widely deployed OSS projects where it can apply automated security analysis, scoring, and remediation guidance to their open source maintainer communities.
I have also been looking at the supply chain side to identify the different vulnerabilities in the system (including hardware), wherein the different sub-systems can have specific “backdoors” and become vulnerable for “hacking”. This is the simplified understanding of a complex issue, because “globalised”, “flat-world” has myriad suppliers for “just-in-time” manufacturing principles. It is difficult (and almost impossible) to ensure the integrity of complex hardware/software combinations. Hence, I found this as an interesting development on the software side and decided to post here.
Its implications will be for AI algorithmic research and “open-sourcing” it with some degree of clinical implementation. It is critical to ensure that software has strong certification systems to ensure its wider application.
RadOncNotes 